What if users don't have IPv6 enabled in TCP settings of the network adapter? Does is have any effect on NETransparentProxyNetworkSettings initialized with tunnelRemoteAddress set to IPv6? If yes, is it possible to use NETransparentProxyNetworkSettings(tunnelRemoteAddress: "localhost") and let the system figure out the address? Or is it better to just always use "127.0.0.1"? In some cases when user doesn't use IPv6 (for one reason on another) we see NETransparentProxyNetworkSettings configuration in System Preferences -> Network to switch repeatedly and indefinitely between disconnected and connected state. Could it be caused by using "::1" as tunnelRemoteAddress? Thanks.

I found a problem where Network filter ends up in state "Connecting" when Network System Extension is slightly delayed during initialization. func main() { autoreleasepool { NEProvider.startSystemExtensionMode() } DoSomething() Thread.sleep(forTimeInterval: 5) // Simulating the task takes a little longer CFRunLoopRun() } main() This usually happens during Sysgem Extension upgrade and also possibly during reboot. When the client app registers system extension it get callback very quickly, becasue it has already been approved by the user. Then it calls loadFromPreferences() to load configuration, which already exists so it is quite fast, then Network filter switches into state "Connecting", however System Extension hasn't completed its init yet. Network filter remains in state Connecting and never recovers. I have to manually click "Disconnect" and it instantly connencts and filter ends up in proper state "Connected". Why doesn't the filter get into Connected state, when extension is finally fully initialized? I understand that system extension needs to initialize as quickly as possible, but it shouldn't be so unreliable if somebody adds extra 100ms to the init process or some undeterministic code sequence, whther it takes 0.1s or 2s. Is there a way to fix it by using standard Apple APIs? If not, how to resolve that issue? I see the following options: Run the Apple APIs startSystemExtensionMode(), etc. as fast as possible and do the other setup in background thread (updating network filter, adding filtering ports, etc) - however it still does not completely resolve the issue that System Extension init might be delayed by high CPU load (let's some other tasks are running or daemons are starting during reboot). Implement timer and when the timer expires, check if Network filter is in state "Connecting" and if not, disable and enable the filter to try reconnect (in this case there is no proxy server/daemon on the other side, we are not really connecting anywhere, just need to receive handleNewFlow() events). System Extension could notify client that it completed initialization and then client wpould check filter state and if still in "Connecting" state, it would try to disable and enebale it, so it could reconnect. Any suggestions? Thanks.

Hi guys, is there a way to detect if es_message_t reports an event where a process is trying to access file in sandbox? Is there a way to mute this type of event? I know it is possible to mute a process, but that process might still access other location than just sandbox. For example Apple's installd needs access to: /Library/InstallerSandboxes/.PKInstallSandboxManager/DE149785-B407-4C06-9571-5A2AA81D061E.activeSandbox Extracting file:///var/folders/rw/spcsf6q91wvdp7306_4fw9mh0000gn/C/com.apple.appstoreagent/com.apple.appstore/F566BEB3-D9FA-4C14-8ABF-1C2ED22FC90A/mzps15464275679007221414.pkg#OneNote.pkg (destination=/Library/InstallerSandboxes/.PKInstallSandboxManager/DE149785-B407-4C06-9571-5A2AA81D061E.activeSandbox/Root/Applications, uid=0) I would like to ignore this event. For example es_process_t has isPlatformBinary flag. Is there a similar flag for sandbox in es_message_t or es_file_t, e.g. isSandboxed? Thanks, Robert

Hi guys, I'm debugging an issue where an application modifies several files and Endpoint Security System Extenison is receiving many ES_EVENT_TYPE_NOTIFY_CLOSE with modify flag set to 'true' for each file. There are other ES_EVENT_TYPE_NOTIFY_CLOSE events with modify=false, but those are caused by system processes md, mdsworker etc. which is expected. However I see very few ES_EVENT_TYPE_AUTH_OPEN events. For 1 file I see for example: 69 ES_EVENT_TYPE_NOTIFY_CLOSE modified=true and only 2 ES_EVENT_TYPE_AUTH_OPEN with flags=2 (which I think is FWRITE). I thought that for each ES_EVENT_TYPE_NOTIFY_CLOSE event I should have exactly 1 OPEN, CREATE, CLONE or any other relevant event. The documentation isn't very helpful, because it's probably only generated from the code. For ES_EVENT_TYPE_NOTIFY_CLOSE it says "An identifier for a process that notifies endpoint security that it is closing a file." https://developer.apple.com/documentation/endpointsecurity/es_event_type_t/es_event_type_notify_close When does ES_EVENT_TYPE_NOTIFY_CLOSE get triggered exactly? It doesn't look like it is fired only when closing a file. Is it possible that the application keeps file opened and performs seek operation and then writes a few bytes and after every write I get CLOSE event? Is it only an indication of the end of modification or is it indication of closed file? If the file is truly closed, why don't I see more OPEN events or to be exact why don't I see a sequence of events OPEN, CLOSE, OPEN, CLOSE...? Let's say that I need to scan file for viruses, when receiving ES_EVENT_TYPE_AUTH_OPEN I can block access to file, scan it and then allow access, but when receiving CLOSE notification with indication that file was modified, do I need to scan it again? If I receive CLOSE event with modify=true 50 times, do I need to scan the file every time to be sure that I capture modification with potentially dangerous content? Or is the modify flag set to true even if content does not change, and only file attributres are changed? Is there any documentation describing relation of ES_EVENT_* and dependencies between them? Thanks.

Hi guys,I have a firewall project, where I used SimpleFirewall as a template. I created the project from scratch and the firewall works, but during configuration of network filter, macOS shows popup"(null) Would Like to Filter Network Content"In SimpleFirewallSample this message shows"SimpleFirewall Would Like to Filter Network Content"Obviously name of the app is missing. I've done the following:* checked entitlements - setup correctly* nothing missing in Info.plist (Bundle Name, Bundle Dispaly Name, etc), filterManager.localizeDescription is set.* I went through dozens if not hundreds of build settings* I changed window title in the MainMenu.xib to precisely match App bundle name* I tried to set up filter configuration from App bundle instead of common framework I use (I thought perhaps NEFilterProviderConfiguration constructor or saveToPreferences() function perhaps checks which bundle calls it and then system checks code signing).* Tried localization for Base and EN* I verified that Filter config in System Preferences in Network uses name of our app and I checked that if I change filterManager.localizedDescription, it correctly changes in those system settings.* you name it - I have done itThe only clue I found in sysem log is this messagedefault15:22:56.895864+0200MyAppSaving configuration MyApp with existing signature (null)The only difference is that I implemented most of the firewall functionality in a framework, so that it could be reused and app bundle links to this framework. Currently I link against this framework from app bundle and system extension using "Embed & Sign". I cannot use other options, because in that case app cannot communicate with extension. Anyway I created clone of Apple's SimpleFirewall and modified it to use common framework with precise settings as in our project and that works correctly.Nothing appears to be working and I cannot get rid of "(nul)" in the popup message in our project.Does anybody know how from which source macOS popup loads this value?Thanks.Robert